---
apiVersion: v1
kind: ConfigMap
metadata:
  name: fluent-bit-config
  labels:
    k8s-app: fluent-bit
data:
  fluent-bit.conf: |
    [SERVICE]
        Flush         1
        Log_Level     info
        Daemon        off
        Parsers_File  parsers.conf
        HTTP_Server   On
        HTTP_Listen   0.0.0.0
        HTTP_Port     2020
    @INCLUDE input-kubernetes.conf
    @INCLUDE filter-kubernetes.conf
    @INCLUDE output.conf
  input-kubernetes.conf: |
    [INPUT]
        Name              tail
        Tag               kube.kubesystem.*
        Path              /var/log/containers/*_kube-system_*.log
        Parser            docker
        DB                /var/log/_kube-system_.db
        Mem_Buf_Limit     5MB
        Skip_Long_Lines   On
        Refresh_Interval  10
    [INPUT]
        Name              tail
        Tag               kube.monitoring.*
        Path              /var/log/containers/*_monitoring_*.log
        Parser            docker
        DB                /var/log/_monitoring_.db
        Mem_Buf_Limit     5MB
        Skip_Long_Lines   On
        Refresh_Interval  10
    [INPUT]
        Name              tail
        Tag               kube.ingress-nginx.*
        Path              /var/log/containers/*_ingress-nginx_*.log
        Parser            docker
        DB                /var/log/_ingress-nginx_.db
        Mem_Buf_Limit     5MB
        Skip_Long_Lines   On
        Refresh_Interval  10
    [INPUT]
        Name              tail
        Tag               kube.nfs-client.*
        Path              /var/log/containers/*_nfs-client_*.log
        Parser            docker
        DB                /var/log/_nfs-client_.db
        Mem_Buf_Limit     5MB
        Skip_Long_Lines   On
        Refresh_Interval  10
    [INPUT]
        Name tail
        Tag sysapp.gen.log.mail
        Parser sys_log_file
        Path /var/log/mail
        db /var/log/_mail_.db
    [INPUT]
        Name tail
        Tag sysapp.gen.log.secure
        Parser sys_log_file
        Path /var/log/secure
        db /var/log/_secure_.db
    [INPUT]
        Name tail
        Tag sysapp.gen.log.messages
        Parser sys_log_file
        Path /var/log/messages
        db /var/log/_messages_.db
    [INPUT]
        Name tail
        Tag sysapp.gen.log.cron
        Parser sys_log_file
        Path /var/log/cron
        db /var/log/_cron_.db
  filter-kubernetes.conf: |
    [FILTER]
        Name                kubernetes
        Match               kube.kubesystem.*
        Kube_URL            https://kubernetes.default.svc.cluster.local:443
        Kube_CA_File        /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        Kube_Token_File     /var/run/secrets/kubernetes.io/serviceaccount/token
        Kube_Tag_Prefix     kube.kubesystem.var.log.containers.
        Merge_Log           On
        Merge_Log_Key       log_processed
        K8S-Logging.Parser  Off
        K8S-Logging.Exclude Off
    [FILTER]
        Name                kubernetes
        Match               kube.monitoring.*
        Kube_URL            https://kubernetes.default.svc.cluster.local:443
        Kube_CA_File        /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        Kube_Token_File     /var/run/secrets/kubernetes.io/serviceaccount/token
        Kube_Tag_Prefix     kube.monitoring.var.log.containers.
        Merge_Log           On
        Merge_Log_Key       log_processed
        K8S-Logging.Parser  Off
        K8S-Logging.Exclude Off
    [FILTER]
        Name                kubernetes
        Match               kube.ingress-nginx.*
        Kube_URL            https://kubernetes.default.svc.cluster.local:443
        Kube_CA_File        /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        Kube_Token_File     /var/run/secrets/kubernetes.io/serviceaccount/token
        Kube_Tag_Prefix     kube.ingress-nginx.var.log.containers.
        Merge_Log           On
        Merge_Log_Key       log_processed
        K8S-Logging.Parser  Off
        K8S-Logging.Exclude Off
    [FILTER]
        Name                kubernetes
        Match               kube.nfs-client.*
        Kube_URL            https://kubernetes.default.svc.cluster.local:443
        Kube_CA_File        /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        Kube_Token_File     /var/run/secrets/kubernetes.io/serviceaccount/token
        Kube_Tag_Prefix     kube.nfs-client.var.log.containers.
        Merge_Log           On
        Merge_Log_Key       log_processed
        K8S-Logging.Parser  Off
        K8S-Logging.Exclude Off
    [FILTER]
        Name modify
        Match sysapp.gen.log.mail
        Set app syslog
        Set file /var/log/mail
    [FILTER]
        Name modify
        Match sysapp.gen.log.secure
        Set app syslog
        Set file /var/log/secure
    [FILTER]
        Name modify
        Match sysapp.gen.log.messages
        Set app syslog
        Set file /var/log/messages
    [FILTER]
        Name modify
        Match sysapp.gen.log.cron
        Set app syslog
        Set file /var/log/cron
  output.conf: |
    [OUTPUT]
        Name            forward
        Match           *
        Host            fluentd-forward
        Port            24224
  parsers.conf: |
    [PARSER]
        Name   nginx
        Format regex
        Regex ^(?<remote>[^ ]*) (?<host>[^ ]*) (?<user>[^ ]*) \[(?<time>[^\]]*)\] "(?<method>\S+)(?: +(?<path>[^\"]*?)(?: +\S*)?)?" (?<code>[^ ]*) (?<size>[^ ]*)(?: "(?<referer>[^\"]*)" "(?<agent>[^\"]*)")?$
        Time_Key time
        Time_Format %d/%b/%Y:%H:%M:%S %z
    [PARSER]
        Name   json
        Format json
        Time_Key time
        Time_Format %d/%b/%Y:%H:%M:%S %z
    [PARSER]
        Name        docker
        Format      json
        Time_Key    time
        Time_Format %Y-%m-%dT%H:%M:%S.%L
        Time_Keep   On
    [PARSER]
        Name        syslog
        Format      regex
        Regex       ^\<(?<pri>[0-9]+)\>(?<time>[^ ]* {1,2}[^ ]* [^ ]*) (?<host>[^ ]*) (?<ident>[a-zA-Z0-9_\/\.\-]*)(?:\[(?<pid>[0-9]+)\])?(?:[^\:]*\:)? *(?<message>.*)$
        Time_Key    time
        Time_Format %b %d %H:%M:%S
    [PARSER]
        Format regex
        Name sys_log_file
        Regex (?<message>(?<time>[^ ]*\s{1,2}[^ ]*\s[^ ]*)\s(?<host>[a-zA-Z0-9_\/\.\-]*)\s.*)$
        Time_Format %b %d %H:%M:%S
        Time_Keep Off
        Time_Key time
        Time_Offset +0300
